throwaway125

Giving another company the ability to serve content (javascript) on a subdomain would make ad companies prime targets for all kinds of hacking campaigns. Their ability to serve javascript and probably access session cookies on a large number of domains would turn them in some kind of skeleton key. This is bad for both the advertisers, the websites serving their ads and the visitors of those websites.

I certainly hope people would think twice about actually implementing something like that.

What bothers me personally the most is the way in which downvotes seem to happen. Don't get me wrong, a lot of users downvote in a good way, so it's not all bad.

Still, I often find grey comments that are brought in a completely respectable way. I feel like these comments are getting downvoted because someone disagrees with them, rather than because they are bad or toxic comments.

The opposite is also true, I often find comments with a positive amount of votes that are in the "internet jokester" style and don't really contribute anything meaningful to the topic at hand.

You can hardly call that good. It's like saying that Diginotar being compromised was good because then we could untrust their CA.

It's true that we could do that, but their original purpose was to protect us in the first place. The same is true for code signing certificates, to a certain extent.

I assume the giant comment is what we're supposed to see, but I'm not sure how that's supposed to have any impact on SEO at all. Seems more like a tribute than a SEO hack.

There are still some restrictions on exporting cryptography. For example, under US law you can't export strong crypto to Iran, North Korea, and a few other countries.

http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...

Thanks to the internet archive we can still enjoy this article:

http://web.archive.org/web/20110225075111/http://tomayko.com...

To clarify I never meant that the limit is a security issue, just that it's a valid technical limitation to limit the length of a password.

For how much people like to repeat the "Use bcrypt!" mantra I'm amazed no one has mentioned the password length limit of bcrypt.

The hash output of bcrypt stops changing after 72 characters but almost all bcrypt documentation mentions a 55 character limit. I'm not quite sure what that is about, can anyone clarify?

The following line in your vimrc will make vim not expand tabs for every file named "Makefile".

    au BufRead,BufNewFile Makefile set noexpandtab

the bottom of their site says © 2013 PeerCDN, Inc. Site design inspired by Meteor.

If the people use a word that happens to be trademarked in a way unrelated or semi related to the trademark then yes, they can and will do that.

exact same story with a https link is already up at the front page: https://news.ycombinator.com/item?id=5419071

I'm really disappointed in the way this story is getting buried. It's quite clear people want to talk about this.

148 points https://news.ycombinator.com/item?id=5416021

I believe this was the first one to be posted, it was on #1 for a bit before it disappeared.

https://news.ycombinator.com/item?id=5416514 This isn't merely pushed off the front page, it's actively declared dead, possibly by automated means.

Someone mentioned the flags are ignored after a post gets 10 upvotes and suggested that maybe the anti spam system is triggered due to the many upvotes in a short period of time.

I think the anti-spam system would not be that quick to react, especially considering some past submissions also have gotten massive amounts of upvotes in a short time (think jslinux or similar).

Possibly true, but that would mean the flag system can be abused to get rid of any articles you don't like. If this is the case that should definitely be looked into.

If it's human intervention then I really don't understand why it's happening: It's quite clear a lot of people want to discuss those messages on the social media accounts of sendgrid.

I really don't understand why these articles keep being removed from the front page. It's quite obvious people want to talk about this.

Same for a venturebeat article: https://news.ycombinator.com/item?id=5416301

I assume this one is next, but why? Is the information false? (perhaps the social accounts are compromised?)

guess this thread is also gone from the front page now.

comment thread of that link: https://news.ycombinator.com/item?id=5416021

It's also on their twitter. Recent tweets seem to indicate it's real: https://twitter.com/SendGrid/status/314768776577036288

Public shaming shows only one perspective. Furthermore this perspective can potentially be fabricated. Public shaming is akin to vigilante justice, and we as a society decided that was a bad way of "justice" for very good reasons.

Checked out some European countries and most seemed to have reasonable results until I got to Iceland. The results from Iceland do indeed suggest the sample set is way too small for some regions.

Agreed, this is a really bad ad. I don't even know what SoapUI does for me and the slides didn't say anything but "APIs are dangerous, protect yourself!"

The users at hackforums are terribly incompetent. These kids all run their command and control center on their local computer. The RAT has one (or several) free dns name(s) embedded and the user keeps updating those with his home ip to receive connections from them.

How hard would it be to launch an investigation into this ip address once you find it out? Would filing John Doe lawsuit allow you to do discovery on those ip addresses? Does 'an ip address is not a person' prevent you from further investigating who the actual person was?

That is definitely true, it's not good enough to secure yourself against a persistent attacker but I do think it's a good captcha:

It's a topical captcha that the target audience of the site will recognize and most likely enjoy.

It's significantly different from any other captcha so that automated untargeted bots will not be able to beat it

It has a high enough entropy that untargeted bots that repeatedly attempt to guess the answer will fail

People without a chess background most likely have to think about the answer in a way that makes buying human workers a less attractive option (maybe)

Always allow your users to opt out of a security question during signup. Give them a friendly warning that you won't be able to assist with lost accounts, but allow them to make that choice.

A lot has been written and said about Bradley Manning but it always seemed such a distant thing. Reading this statement made me realize how he's a real person that I can identify with rather than just some guy in a news article.

That's not how I read it. I see him saying they should have checked their verb list (thought about possible failures, as you said.) He also says that if people are more aware of the algorithmic nature of these things that they are less likely to get offended.

Quite honestly, I think he's right. If people were informed about amazon not being the ones who are selling the t-shirts and the algorithmic nature of the t-shirt generation then people would probably react completely different to encountering that t-shirt.